June 2021| | 19MASTERING CYBERSECURITY EXECUTION: HOW TO AVOID AN EPIC FAIL OF YOUR CYBERSECURITY PROGRAMBy Ramy Houssaini, Chief Cyber and Technology Risk Officer, BNP ParibasCybersecurity is an ongoing concern for global organizations, especially at a time where we are witnessing an acceleration of the digitization of several industries and an increase in the sophistication of the attacks. Under the influence of the C-suite and the Board (and sometimes the regulators), Cyber investments have been steadily increasing over the past 5 years. The increase in the Cyber spend has not always been matched by an improvement in the performance of Cybersecurity. Below are some observations on what makes successful companies more cyber resilient by driving more value from their cyber investments and filling the performance gaps in their programs:1. Zero risk does not exist: Shift the investment paradigm to Cyber Resilience: communicating the unrealistic expectation that there will be zero cyber incidents is a sure recipe for surprises. Investments should focus on the capability (and capacity) to quickly detect issues and contain their impact by stopping attacks and finding/fixing breaches faster. In the face of a Cyber event, you should be able to bend but not break.2. "It's the architecture, stupid": Create a defensible environment by shrinking the attack surface and formalizing a strategic Cybersecurity Architecture: throwing technology solutions at the problem is not going to make it go away nor is it a sustainable approach. By some count, organizations are reporting the use on average, of 60 plus different security products. This introduces complexity and creates opportunities for coverage gaps. Additionally, it dilutes the focus of security operation teams and reduce their individual end to end understanding of the issues due to the fragmentation of the operations. Understanding and governing the attack surface/digital footprint of the organization and working tirelessly on shrinking it along with enacting effective architectures to cover the different scenarios is the right approach. Concentrating your security supply chain is an important consideration.3. Speed is the name of the game: Integrate Cybersecurity telemetry to enable Operational Speed: boost digital protection with data intelligence, razor precision and turbo charging technology. Detection speed is an important consideration when building the technology stack required for analyzing weak signals in the environment. Organizations should invests deeply in analytics and move to predictive models vs. reactive ones. This can only be done if the basics are also mastered operationally.4. You can (but shouldn't) spend your way into security: Scale existing investments and rigorously manage/fight unsustainable cost increases: Quantifying return on risk reduction is important in order to routinely obsolete expensive controls that can be of low value and replacing them with risk (and cost) optimized ones. Additionally, focus should be maintained on automation and achieving scale. I am in favor of having annual operational efficiency targets to keep the security operations in a continuous improvement mindset.CXO INSIGHTSRamy Houssaini
< Page 9 | Page 11 >